Legal mentions & privacy policy

1.1 Introduction 

PALO IT respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your data, as well as your rights under applicable data protection laws.

• PALO IT's privacy policy is aligned with the EU General Data Protection Regulation (GDPR).
  
  
• If you are located in Singapore, PALO IT provides services to you under this privacy policy.
  
  
• If you are located in Thailand, this privacy policy complies with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).
  
  
• If you are located in Hong Kong, this privacy policy complies with the Personal Data (Privacy) Ordinance (PDPO).
  
  
• If you are located in Australia, this privacy policy complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For commercial electronic messages, we comply with the Spam Act 2003. You may direct privacy enquiries or complaints to the Office of the Australian Information Commissioner at oaic.gov.au.
  
  
• If you are located in Brazil, this privacy policy complies with the Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018). You may exercise your data rights within 15 days of your request. The supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
  
  
• If you are located in Colombia, this privacy policy complies with Ley 1581 de 2012 (Habeas Data) and its implementing decrees. You may exercise your Habeas Data rights by contacting us at [privacy@palo-it.com]. International transfers of your personal data are protected by contractual safeguards in accordance with the requirements of the Superintendencia de Industria y Comercio (SIC).
  
  
• If you are located in Mexico, this privacy policy complies with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (in force since March 21, 2025). You have the right to access, rectify, cancel, or oppose the processing of your personal data (ARCO rights) by contacting us at [privacy@palo-it.com].
  
  
• Users in the United States are served under this privacy policy. If you are a California resident, additional rights may apply under the California Consumer Privacy Act (CCPA/CPRA).

1.2 Data We Collect 

We may collect and process the following types of personal data: 

• Contact Information: Name, email address, phone number.
  
  
• Usage Data: IP address, browser type, and other technical data collected during your interaction with our website.

• Communication Data: Information shared when contacting us via forms, emails, or other communication channels. 

• Professional and commercial contact data: Contact details, professional role, and history of exchanges in the context of our business relationships with clients and prospects.

1.3 Legal Bases for Processing Personal Data 

We process your personal data based on the following legal grounds: 

• Consent: When you provide explicit consent for specific purposes, such as subscribing to our newsletter. 

• Contract: When processing is required to fulfill a contract with you. 

• Legal Obligation: When we are required to comply with legal or regulatory obligations. 

• Legitimate Interests: When processing is necessary to fulfill our business interests, provided your rights do not override these interests. 

1.4 How We Use Your Data 

Your personal data may be used for the following purposes: 

• To provide and improve our services.
  
  
• To communicate with you about inquiries or service updates.
  
  
• To comply with legal requirements.
  
  
• To analyze website performance and usage trends.

• To manage our commercial relationships with clients and prospects, including responding to enquiries, managing commercial correspondence, and ensuring continuity of service.

1.5 Data Retention 

We retain personal data only as long as necessary to fulfill the purposes for which it was collected. Our standard retention periods are as follows:

Active clients (current or recent contractual relationship): up to 7 years from the end of the contract or last engagement, as required for legal and financial record-keeping.

Prospects and warm leads (contacts in active sales conversations): up to 3 years from the date of last interaction.

Website enquiries and event registrations (contacts who submitted a form or attended an event with no subsequent engagement): up to 2 years from submission.

Cold outreach contacts (contacts reached via prospecting campaigns with no response or engagement): up to 1 year from last outreach.

Job applications: up to 6 months from application date, unless a longer period is agreed with the candidate.

Where retention is required by law (e.g. tax, contract, or employment regulations), we retain data for the legally required period, which may exceed the above.

To request information about how long your specific data is retained, or to request deletion, please contact us at [privacy@palo-it.com].

1.6 Your Rights 

You have the following rights concerning your personal data: 

• Access: Request access to the personal data we hold about you. 

• Correction: Request correction of inaccurate or incomplete data. 

• Erasure: Request deletion of your data, subject to legal obligations. 

• Restriction: Request restriction of data processing under certain circumstances. 

• Portability: Request the transfer of your data to another organization or directly to you. 

• Objection: Object to processing based on legitimate interests. 

To exercise any of these rights, please contact our Data Protection Officer: Group Data Protection Officer: Jing Lei
Email: [privacy@palo-it.com]

We will respond to your request within 30 days (GDPR), 15 days (LGPD/Brazil), or 45 days (CCPA/California), depending on your location. Where we are unable to fulfil your request, we will explain why and inform you of your right to lodge a complaint with the relevant supervisory authority.

1.7 Application for Jobs 

Our website allows candidates to apply for employment opportunities by submitting personal data such as contact information, professional experience, roles of interest, and other details. If you provide any personal or special categories of data (e.g., via a resume or an application form), the submitted information will be processed by PALO IT as the data controller.

Please note that job application forms and data management services are provided by Ashby, Inc., located at 548 Market Street, San Francisco, CA 94104, USA (www.ashbyhq.com) as our service provider. Personal data submitted will be collected, stored, and processed on our behalf by Ashby and shared with the respective PALO IT entities involved in processing your application.

Any transfer of your personal data outside the EU/EEA related to Ashby's services is protected under Standard Contractual Clauses (EU SCCs) and the EU-U.S. Data Privacy Framework (DPF), to which Ashby is a registered member.

Additionally, during the registration process on our job application portal, your IP address and the date and time of your registration will be recorded. This measure is implemented to prevent unauthorised use of our services.

1.8 Registration on Our Website 

If you register for services, events, or resources via our website, or submit a message through our contact forms, your personal data will be processed by PALO IT as the data controller to deliver the requested services. 

All registration forms are hosted and managed by HubSpot, Inc., located at 25 First Street, 2nd Floor, Cambridge, MA 02141, USA. HubSpot securely collects and stores your personal data on our behalf. For more details, visit HubSpot’s Privacy Policy.

We also use HubSpot to manage communications and relationships with our clients and prospects, on the basis of our legitimate interest in developing and maintaining business relationships. Personal data transferred to HubSpot (USA) is protected by Standard Contractual Clauses under our Data Processing Agreement with HubSpot. For more information, see HubSpot's data transfer commitments.

2.1 General Information 

PALO IT’s websites use cookies to store and retrieve information about your visit to our sites. Cookies are small software files that help websites save and recall information about your preferences and past activities. These files reside in your browser to improve your browsing experience. For more details about cookies, visit www.allaboutcookies.org. 

We and our partners (e.g., analytics providers) use cookies and log files to analyze trends, administer the website, track users’ movements, and gather demographic data. These technologies help us provide website content, ensure IT system functionality, and optimize our site. Reports based on anonymized, aggregated data may also be generated. 

Users can manage or refuse cookies through their browser settings. If you have previously visited our website, you may need to clear existing cookies before updating your preferences. Rejecting cookies may limit some features or functionalities of our website.

Email communications: Our sales team may use email tracking features (such as read receipts or link tracking) in commercial correspondence to support follow-up and relationship management. Where required by applicable law — including in the European Union, Brazil, Thailand, and Colombia — we do not enable these features without appropriate consent or lawful basis. If you have any questions about this, please contact us at [privacy@palo-it.com].

2.2 Categories of Cookies 

• Google Analytics Cookies: Our website uses Google Analytics, a web analytics service provided by Google, Inc., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies to analyze how visitors use our website. The data collected (e.g., time, location, and frequency of site visits) may be transmitted to Google servers in the United States. To enhance user privacy, our site employs the "anonymize IP" feature, which masks IP addresses before transmission within EU/EEA member states. You can learn more about managing Google Analytics cookies or opt out via Google’s Browser Add-on. 

• Strictly Necessary Cookies: Enable essential site functionality and cannot be disabled. 

• Registered Visitor Cookies: Assign unique identifiers to registered users for anonymous session tracking. 

• Performance Cookies: Collect anonymized data for site improvement. 

• Functional Cookies: Remember user preferences and enhance personalized features. 

• Targeting Cookies: Support analytics and provide insights into user behavior to improve the user experience. 

3.1 Publisher of the Site 

This website is owned and operated by PALO IT Group Limited, 23/F., One Taikoo Place, 979 King's Road, Quarry Bay, Hong Kong SAR.

3.2 Hosting 

This website is hosted by HubSpot, Inc., located at 25 First Street, 2nd Floor, Cambridge, MA 02141, USA. HubSpot provides our Content Management System (CMS) and ensures compliance with industry-standard security protocols to protect your data. For more details on HubSpot's data protection measures, visit their Privacy Policy. 

3.3 Terms and Conditions of Use 

PALO IT shall not be liable for any direct, indirect, incidental, or consequential damages arising from the use or inability to use this website. These terms are governed by the laws of Hong Kong SAR, where PALO IT Group is headquartered. For disputes related to services provided by local PALO IT offices, the applicable laws of the respective local jurisdiction shall apply. 

3.4 Content of External Websites 

Links to external websites are provided for convenience. PALO IT is not responsible for the content or reliability of external websites. 

At PALO IT, we are committed to creating meaningful social impact and embedding ethical practices throughout our operations as we work towards Certified B Corporation status. We recognize the importance of addressing modern slavery and human trafficking risks in our supply chains, collaborating with trusted suppliers who align with our governance standards. For more details on our commitment, please refer to our full Statement on Modern Slavery. 

* In any official capacity, the English version of our Legal Mentions shall prevail. For any discrepancies or interpretations, please refer to the English text.